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This action is in response to the communication filed on 6/14/2006. 
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Response to Arguments 
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Applicants' arguments filed 6/14/2006 have been fully considered but they are not 
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persuasive. 
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Regarding applicants' argument that the amendments have overcome the prior rejections 



7 under 35 USC 112 2" Paragraph, the examiner points out that there still exists multiple 

8 antecedent basis for the limitations "said fingerprint data" in the later parts of the claims. As 

9 such, the examiner has maintained the rejections. The examiner encourages the applicants to 

10 specifically point out which fingerprint data (the generated fingerprint data or the known 

1 1 fingerprint data) is being referred to by the claim language. 

12 Regarding applicants' amendment to overcome the rejections under 35 USC 101, the 

13 examiner points out that simply asserting that the medium is "tangible" is not enough to make 

14 the computer program product statutory. Furthermore, the applicants have provided no 

15 explanation as to what a "tangible" computer readable medium encompasses. Therefore, the 

16 examiner suggests the following language: "in a computer storage medium", as is consistent 

17 with the instant specification paragraph 0052, 

18 Regarding applicants' argument that Hypponen teaches signatures of "macros", the 

19 examiner does not find the argument persuasive. Although Hypponen does pertain to "macros", 

20 more generally, Hypponen pertains to comparison of two checksums for determining whether a 

21 set of data contains malicious data, and it would have been readily apparent to one of ordinary 

22 skill in the art at the time of invention that comparison between checksums would be faster than 
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comparison of the entire set of data the checksums were derived from. As such, the examiner 
does not find the argument persuasive. 

Regarding applicants' argument that Cozza and Hypponen did not disclose the fingerprint 
data including a flag indicating which data is included within said fingerprint data, the examiner 
has previously addressed this argument and is again not persuaded. 

Regarding applicants' argument that Cozza and Hypponen did not disclose that the 
fingerprint data included a program resource item having a largest size, the examiner does not 
find the argument persuasive. It was obvious that in the combination, a program resource having 
a largest size was included in the fingerprint, as resources were included and it was inherent that 
one of the included resources was the largest of the included resources. Therefore, the examiner 
does not find the argument persuasive. 

Regarding applicants' argument that Cozza and Hypponen did not disclose comparing 
said resource data with characteristics of a plurality of known computer programs. . . ", the 
examiner does not find the argument persuasive. The scanning of the resource fork for resource 
fork viruses does fall within the scope of claim recitation as in order to scan one set of data for 
second set of data, the characteristics of the second set must be compared with the first. As such 
the examiner does not find the argument persuasive. 

Regarding applicants' argument that Cozza and Hypponen did not disclose 
"hierarchically arranged resource data" the examiner does not find the argument persuasive. 
This is due to the fact that the although Cozza did not specifically state that the data was 
hierarchically arranged, the file is separated into a data fork and a resource fork, which causes 
the resources in the resource fork to be in a "hierarchical arrangement". Furthermore, Cozza 
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1 disclosed that these were Macintosh Files, and it was common knowledge that the resource fork 

2 of a Macintosh file was arranged into a hierarchy of resources. Therefore, the examiner does not 

3 find the argument persuasive. 

4 Regarding applicants' argument that Cozza and Hypponen did not disclose that said 

5 "checksum value is rotated between each item being added into said checksum" the examiner 

6 does not find the argument persuasive. If the checksum is rotated after each operation, as is 

7 SHA, then it stands that "between each item" the checksum was rotated. 

8 Regarding applicants' argument that Hodges does not disclose a "time of compilation", 

9 the examiner does not find the argument persuasive. Hodges teaches that the time that the 

10 signature (fingerprint) data was compiled should be included with the signatures and as such this 

1 1 timestamp indicates the time of compilation of the viruses (known computer program) into the 

12 DAT files, which meets the limitation of the claim language. Therefore the examiner does not 

13 find the argument persuasive. 

14 Because the examiner does not find the argument persuasive, the prior art rejections 

1 5 presented in the final office action dated 6/10/2005 have been maintained. 

16 Claims 1-3, 5-9, 12, 14-19, 21-25, -28, 30-35, 37-41, 44, 46-51, 53-57, 60, 62-67, 69-73, 

17 76, 78-83, 85-89, 92, and 94-98 have been examined, while claims 4, 10-11, 13, 20, 26-27, 29, 

18 36, 42-43, 45, 52, 58-59, 61, 68, 74-75, 77, 84, 90-91, and 93 have been cancelled. 

19 All objections and rejections not set forth below have been withdrawn. 

20 Claim Rejections - 35 USC § 112 

21 The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

22 The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 

23 subject matter which the applicant regards as his invention. 
24 
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1 Claims 1-3, 5-9, 12, 14-19, 21-25, 28, 30-35, 37-41, 44, 46-51, 53-57, 60, 62-67, 69-73, 

2 76, 78-83, 85-89, 92, and 94-98 are rejected under 35 U.S.C. 1 12, second paragraph, as being 

3 indefinite for failing to particularly point out and distinctly claim the subject matter which 

4 applicant regards as the invention. 

5 Claims 1,17, 33, 49, 65, and 81 recite the limitation "said fingerprint data" in the last 4 

6 lines. There is multiple antecedent basis for this limitation in the claim. It is unclear to which 

7 fingerprint data this is referring and therefore the ordinary person skilled in the art would not be 

8 able to determine the scope of the claim. Therefore, the claims are rejected for failing to 

9 particularly point out and distinctly claim the subject matter which the applicant regards as the 

10 invention. For the purposes of searching prior art, the examiner will assume these were referring 

1 1 to either of the fingerprint data, 

12 Claims 1, 17, 33, 49, 65, and 81 recite the limitation "said resource data" in the 3 rd to last 

13 line. There is multiple antecedent basis for this limitation in the claim. It is unclear to which 

14 resource data this is referring and therefore the ordinary person skilled in the art would not be 

15 able to determine the scope of the claim. Therefore, the claims are rejected for failing to 

16 particularly point out and distinctly claim the subject matter which the applicant regards as the 

17 invention. For the purposes of searching prior art, the examiner will assume these were referring 

1 8 to either of the resource data. 

19 Claims 3, 19, 35, 51, 67, and 83 recite the limitation "said resource data". There is 

20 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

21 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

22 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 
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1 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 

2 of searching prior art, the examiner will assume these were referring to either of the resource 

3 data. 

4 Claims 6, 22, 38, 54, 70, and 86 recite the limitation "said resource data". There is 

5 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

6 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

7 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

8 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 

9 of searching prior art, the examiner will assume these were referring to either of the resource 

10 data. 

1 1 Claims 7, 23, 39, 55, 71, and 87 recite the limitation "said resource data". There is 

12 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

13 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

14 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

1 5 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 

16 of searching prior art, the examiner will assume these were referring to either of the resource 

17 data. 

18 Claims 8, 24, 40, 56, 72, and 88 recite the limitation "said resource data". There is 

19 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

20 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

21 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

22 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 



Application/Control Number: 09/9 1 2,3 89 Page 7 

Art Unit: 2131 

1 of searching prior art, the examiner will assume these were referring to either of the resource 

2 data. 

3 Claims 9, 25, 41, 57, 73, and 89 recite the limitation "said resource data". There is 

4 multiple antecedent basis for this limitation in the claim. It is unclear to which resource data this 

5 is referring and therefore the ordinary person skilled in the art would not be able to determine the 

6 scope of the claim. Therefore, the claims are rejected for failing to particularly point out and 

7 distinctly claim the subject matter which the applicant regards as the invention. For the purposes 

8 of searching prior art, the examiner will assume these were referring to either of the resource 

9 data. 

10 Claims 9, 25, 41, 57, 73, and 89 recite the limitation "said fingerprint data". There is 

1 1 multiple antecedent basis for this limitation in the claim. It is unclear to which fingerprint data 

12 this is referring and therefore the ordinary person skilled in the art would not be able to 

13 determine the scope of the claim. Therefore, the claims are rejected for failing to particularly 

14 point out and distinctly claim the subject matter which the applicant regards as the invention. 

15 For the purposes of searching prior art, the examiner will assume these were referring to either of 

16 the fingerprint data. 

17 Claims 12, 28, 44, 60, 76, and 92 recite the limitation "said fingerprint data". There is 

18 multiple antecedent basis for this limitation in the claim. It is unclear to which fingerprint data 

19 this is referring and therefore the ordinary person skilled in the art would not be able to 

20 determine the scope of the claim. Therefore, the claims are rejected for failing to particularly 

21 point out and distinctly claim the subject matter which the applicant regards as the invention. 
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1 For the purposes of searching prior art, the examiner will assume these were referring to either of 

2 the fingerprint data. 

3 Any claim not specifically mentioned above has been rejected by virtue of its dependency 

4 to a specifically mentioned claim. 

5 Claim Rejections - 35 USC §101 

6 35 U.S.C. 101 reads as follows: 

7 Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 

8 any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 

9 requirements of this title. 

10 

1 1 Claims 1-3, 5-9, 1 1-12, 14-19, 21-25, 27-28, and 30-32 are rejected under 35 U.S.C. 101 

12 because the claimed invention is directed to non-statutory subject matter. These claims are 

13 directed only to a "computer program product". A computer program product per se could 

14 simply be a computer program written on paper, which does not fall within any of the statutory 

15 categories of patentable subject matter. The specification does not provide any metes and 

1 6 bounds for a computer program product and therefore a reasonable interpretation of a computer 

1 7 program product would include a computer program written on paper. Therefore the claims are 

1 8 rejected for being directed towards no n- statutory subject matter. See MPEP § 2106. Further see 

19 the remarks above under the section "response to arguments". 

20 Claim Rejections - 35 USC §103 

21 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

22 obviousness rejections set forth in this Office action: 

23 A patent may not be obtained though the invention is not identically disclosed or 

24 described as set forth in section 102 of this title, if the differences between the subject matter 

25 sought to be patented and the prior art are such that the subject matter as a whole would have 

26 been obvious at the time the invention was made to a person having ordinary skill in the art to 
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1 which said subject matter pertains. Patentability shall not be negatived by the manner in which 

2 the invention was made. 
3 

4 Claims 1-3, 5, 9, 12, 14, 17-19, 21, 25, 28, 30, 33-35, 37, 41, 44, 46, 49-51, 53, 57, 60, 

5 62, 65-67, 69, 73, 76, 78, 81-83, 85, 89, 92, 94, and 98 are rejected under 35 U.S.C. 103(a) as 

6 being unpatentable over Cozza (US Patent Number 5,649,095), and further in view of Hypponen 

7 et al. (US Patent Number 6,577,920) hereinafter referred to as Hypponen. 

8 Regarding claims 1,17, 33, 49, 65, and 81, Cozza disclosed a system, method, and 

9 computer program product (See Cozza Claims and Col. 1 Lines 26-33) comprising a computer 

10 program operable to control a computer to detect a known computer program within a packed 

1 1 computer file, said packed computer file being unpacked upon execution, said computer program 

12 comprising (See Cozza Abstract and Col. 3 Paragraph 6: resource data reading logic for reading 

13 resource data within said packed computer file (See Cozza Col. 6 Lines 21-23 and 29-34), said 

14 resource data specifying program resource items used by said known computer program (See 

15 Cozza Col. 2 Paragraph 7) and readable by a computer operating system without dependence 

16 upon which unpacking algorithm is used by said packed computer file (See Cozza Col. 6 

17 Paragraphs 2-3 wherein the compressed file is not decompressed in order to read the resource 

18 forks information); and resource data comparing logic for generating characteristics of said 

19 resource data (See Cozza Paragraph 1 Lines 58-65 wherein it was inherent that the characteristic 

20 data was generated in order for the data to have been compared) and for comparing said 

21 characteristics of said resource data with characteristics of resource data of said known computer 

22 program (See Cozza Col. 7 Lines 35-39 and Col. 1 Lines 58-65) and for detecting a match with 

23 said known computer program indicative of said packed computer file containing said known 
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1 computer program (See Cozza Col. 7 Lines 35-39 and Col. 1 Lines 58-65), and wherein said 

2 fingerprint data includes a location within said resource data of an entry specifying a program 

3 resource item having a largest size (See Cozza Col. 6 Lines 29-45), but Cozza failed to disclose 

4 wherein said resource data of said packed computer file is processed to generate fingerprint data 

5 and to compare said fingerprint data with fingerprint data of said known computer program; 

6 wherein said fingerprint data includes a number of program resource items specified within said 

7 resource data; or wherein said fingerprint data includes a flag indicating which data in included 

8 within said fingerprint data. However, Cozza did disclose the file including a number of 

9 program resource items specified within said resource data (See Cozza Col. 2 Paragraph 7), and 

10 a set of flags indicating what data was contained in the file (See Cozza Col. 3), and comparing 

1 1 the resource data with resource data of a known program (See Cozza Col. 1 Lines 58-65, Col. 6 

12 Paragraph 3, and Col. 7 Lines 35-40). 

13 Hypponen teaches a method of virus scanning in which signatures (fingerprint) of a file 

14 are created and compared to signatures of known infected files in order to detect viruses (See 

15 Hypponen Col. 3 Lines 14-25). 

16 It would have been obvious to the ordinary person skilled in the art at the time of 

17 invention to employ the teachings of Hypponen in the virus scanning of Cozza by creating a 

18 signature of the resources of the compressed file and comparing it to previous signatures. This 

19 would have been obvious because the ordinary person skilled in the art would have been 

20 motivated to scan the files as quickly as possible, without compromising security. It would have 

21 been obvious in this combination that because the file contains the resource fork and resource 

22 items, and the signature is taken of the file, the signature includes a number of resource items 
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1 specified within the resource fork. It further would have been obvious that because the 

2 fingerprint data represented the file during comparison, and the flags of Cozza indicated the 

3 viruses found in the file, the fingerprint data would have included a flag indicating which data 

4 (viruses) was included within said fingerprint data. 

5 Regarding claims 2, 18, 34, 50, 66, and 82, Cozza and Hypponen disclosed that said 

6 known computer program is one of: a Trojan computer program; and a worm computer program 

7 (See Cozza Col. 1 Lines 22-32 and Col. 7 Lines 35-39). 

8 Regarding claims 3, 19, 35, 51, 67, and 83, Cozza and Hypponen disclosed that said 

9 resource data comparing logic is operable to compare said resource data with characteristics of a 

10 plurality of known computer programs to detect if said packed computer program contains one of 

1 1 said plurality of known computer programs (See Cozza Col. 7 Lines 35-40). 

12 Regarding claims 5, 21, 37, 53, 69, and 85, Cozza and Hypponen disclosed that said 

13 program resource items used by said known computer program include one or more of: icon 

14 data; string data; dialog data; bitmap data; menu data; and language data (See Cozza Col. 2 

15 Paragraph 7). 

16 Regarding claims 9, 25, 41, 57, 73, and 89, the combination of Cozza and Hypponen 

1 7 disclosed the fingerprint data including a checksum (See Hypponen Col. 4 Lines 55-59) value 

18 calculated in dependence upon one or more of: a number of program resource items specified 

19 beneath each node within hierarchically arranged resource data; string names associated with 

20 program resource items within said resource data; and sizes of program resource items within 

21 said resource data (See Cozza Col. 5 Lines 1-9 wherein it would have been inherent that the size, 
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1 or amount of data, the string names in the data, and the number of the resource items in that data 

2 would have effected the calculation of the checksum). 

3 Regarding claims 14, 30, 46, 62, 78, 94, and 98, Cozza and Hypponen disclosed the 

4 checksum being SHA, which shifts 1 bit to the left after each operation (See Hypponen Col. 4 

5 Lines 56-59). 
6 

7 Claims 12, 28, 44, 60, 76, and 92 are rejected under 35 U.S. C. 103(a) as being 

8 unpatentable over the combination of Cozza and Hypponen as applied to claims 4, 20, 36, 52, 68, 

9 and 84 above respectively, and further in view of Hodges et al. (US Patent Number 6,269,456) 

1 0 hereinafter referred to as Hodges. 

1 1 The combination of Cozza and Hypponen disclosed creating fingerprint data for detecting 

12 viruses (See rejection of claim 4 above), but failed to disclose providing a time of compilation in 

1 3 the fingerprint data. 

14 Hodges teaches that in a virus protection system, virus signature files can be 

1 5 automatically updated with new signatures when necessary, if a latest revision time is provided 

16 with the files (See Hodges Col. 2 Paragraph 6 and Col. 4 Paragraph 6). 

17 It would have been obvious to the ordinary person skilled in the art at the time of 

18 invention to employ the teachings of Hodges in the virus scanning system of Cozza and 

19 Hypponen by providing a time of revision with each signature. This would have been obvious 

20 because the ordinary person skilled in the art would have been motivated to ensure that the 

21 system was protected against the most recently discovered viruses. 



! 
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1 Claims 6-8, 15-16, 22-24, 31-32, 38-40, 47-48, 54-56, 63-64, 70-72, 79-80, 86-88, and 

2 95-97 are rejected under 35 U.S.C. 103(a) as being unpatentable over the combination of Cozza 

3 and Hypponen as applied to claims 1,17, 33, 49, 65, and 81 above, and further in view of Pietrek 

4 ("Peering Inside the PE: A Tour of the Win 32 Portable Executable"). 

5 Regarding claims 16, 32, 48, 64, 80, and 96, Cozza and Hypponen disclosed detecting a 

6 known computer program in a compressed computer file, the file including resource data (See 

7 rejection of claim 1 above), but failed to specifically name the Win32 PE file as one of these 

8 files. 

9 Pietrek teaches that a Win32 PE file is an executable file which contains un-initialized 

10 code and resources, which when executed the code is initialized using the resources (See Pietrek 

11 Page 2 1 PE File Base Relocations). 

12 It would have been obvious to the ordinary person skilled in the art at the time of 

13 invention to employ the teachings of Pietrek in the virus detector of Cozza and Hypponen by 

14 allowing the scanning of Win32 PE files and their resources. This would have been obvious 

1 5 because the ordinary person skilled in the art would have been motivated to provide protection 

16 against Win32 PE files containing viruses. 

17 Regarding claims 6-8, 22-24, 38-40, 54-56, 70-72, and 86-88, the combination of Cozza, 

18 Hypponen and Pietrek disclosed specifying a storage location for each resource item as an offset, 

19 and the size of each resource (See Pietrek Page 20 Table 13 Offsets and Page 21 Fig, 14 

20 DWORD OffsetToData). 
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1 Regarding claims 15, 31, 47, 63, 79, and 95, Cozza, Hypponen and Pietrek disclosed 

2 decompressing the computer program upon execution (See Pietrek Page 21 PE File Base 

3 Relocations). 

4 Regarding claim 97, Cozza, Hypponen, and Pietrek disclosed that the checksum value 

5 depended upon: a number of program resource items specified beneath each node within 

6 hierarchically arranged resource data; string names associated with program resource items 

7 within said resource data; and sizes of program resource items within said resource data (See the 

8 rejection of claim 1 above, and further see Pietrek Fig. 5 and Table 13). 

9 Conclusion 

10 Claims 1-3, 5-9, 12, 14-19, 21-25, 28, 30-35, 37-41, 44, 46-51, 53-57, 60, 62-67, 69-73, 

1 1 76, 78-83, 85-89, 92, and 94-98 have been rejected. 

12 THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 

13 policy as set forth in 37 CFR 1 .136(a). 

14 A shortened statutory period for reply to this final action is set to expire THREE 

15 MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 

16 MONTHS of the mailing date of this final action and the advisory action is not mailed until after 

17 the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 

18 will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 

19 CFR 1. 136(a) will be calculated from the mailing date of the advisory action. In no event, 

20 however, will the statutory period for reply expire later than SIX MONTHS from the mailing 

2 1 date of this final action. 
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1 Any inquiry concerning this communication or earlier communications from the 

2 examiner should be directed to Matthew T. Henning whose telephone number is (571) 272-3790. 

3 The examiner can normally be reached on M-F 8-4. 

4 If attempts to reach the examiner by telephone are unsuccessful, the examiner's 

5 supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 

6 organization where this application or proceeding is assigned is 571-273-8300. 

7 Information regarding the status of an application may be obtained from the Patent 

8 Application Information Retrieval (PAIR) system. Status information for published applications 

9 may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

10 applications is available through Private PAIR only. For more information about the PAIR 

1 1 system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

12 system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

13 
14 
15 
16 

20 Matthew Henning 

2 1 Assistant Examiner 

22 Art Unit 2131 

23 8/27/2006 
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